Spam; Routing Restrictions; Destination Hosts.

[2know]

First - sorry to be so long winded but please read on....

Ok, I started getting large amounts of Junk Mail and didn't know why because nothing had changed on my Exchange 5.5 sp4 box.
From this web site and Microsoft's site I learned that my mail server could be a relay server. This made sense because under the IMC Queues tab I am getting &quot;Destination Hosts&quot; with an originator of <>. (I never used to get these in the past)
I took all the steps I learned from the threads on this page that coincided with an article I found on Microsoft's page of making sure my server is not a relay. I tested it and as far as I can tell, it's not a relay server (anymore).
To block the SPAM, I even created a list of &quot;email address&quot;, &quot;domain&quot; and &quot;@domain&quot; addresses, some of which came from this site, and added them to the &quot;Message Filtering&quot; section under the &quot;Connections&quot; tab of the IMC. (This seems to of only &quot;slowed down the junk mail that I NEVER used to get.)
I do however realize that you can never &quot;totally&quot; get rid of junk mail.

With these changes,
1.) The outgoing mail to the Internet is slow to leave the server but it does eventually leave.
2.) I still get &quot;Destination Hosts&quot; with an originator of <>
3.) I have had a few instances of my internal people, Steve and George (Steve.Lastname@mycompany.com) get email that was sent to people they don't know (Steve.Stranger@someother.company.com) and the originator of that email is a stranger too for that matter.

If anyone could shine some light on any of these issues it would brighten up my day.
Thanks for reading this and for all the threads that have taken me to this point. It's very much appreciated!

 

[TalentedFool]

In answer to your questions/points:

1) - I get this as well - we use a dial-up connection to our ISP but it may even take two or attempts to leave our server but eventually does. I'm still working on this one so will let you know.

2) One thing I have found, in my gawd awful experiance of SPAM and the open relay issue when I was monitoring our Exchange server I did find out that the Destination Hosts with an originator of <> can be generate by the Out of Office Assistant from Outlook - I don't know why or how the Name of the originator gets blanked out, maybe its a bug or something?!

I've tested this theory as well and everytime I've done it, the test is posotive.

3) The email that they receive to an address like the one you said about, is a distrubtion list on the originators server. Its a simple way of masking who they send email to. Its bascially a SPAM email but may be genuine! I get them from time to time from Marketing companies or sales companies trying to sell us stuff or send us info.

Hope this helps a bit
~ Remember - Nothing is Fool Proof to a Talented Fool ~

 

[Anskia]

Have a look at this article

http://www.exchangeadmin.com/Articles/Index.cfm?ArticleID=7696

(the url has wrapped - it should all appear on one line).
This is the procedure I followed to stop our server being used as an open relay.

Hope this helps,



Robert

 

[2know]

Anskia,
I have used that artical in the past and it was helpful. Thanks for pointing it out!

lwalters,
Thanks too for all your thoughts.

2) I'm not sure how you tested your out of office assistant but it seem like I have A LOT of Destination Hosts with an originator of <> to be something like this. I could be wrong, It's happened before.

3)This has only happened three times (that I know of) but mail FROM a complete stranger addressed TO a complete stranger gets delivered to one of my users that happens to have the same first name of the &quot;TO&quot; recipient. Don't know how that happens....?